Strata Logging Service
File LEEF Fields
Table of Contents
Expand All
|
Collapse All
Strata Logging Service Docs
File LEEF Fields
Example File log in LEEF:
Sep 21 01:52:01 xxx.xx.x.xx 2309 <14>1 2021-09-21T01:52:01.624Z stream-logfwd20-d324e775--09201841-lxtx-harness-b86s logforwarder - panwlogs - LEEF:2.0|Palo Alto Networks|Next Generation Firewall|10.1|17657||TimeReceived=2021-09-21T01:52:00.000000Z DeviceSN=xxxxxxxxxxxxx cat=threat SubType=file ConfigVersion=10.1 devTime=2021-09-21T01:51:53.000000Z src=xxx.xx.x.xx dst=srcPostNAT=xxx.xx.x.xx dstPostNAT= Rule=allow-business-apps usrName=paloaltonetwork\xxxxx DestinationUser=paloaltonetwork\xxxxx Application=profinet VirtualLocation=vsys1 FromZone=datacenter ToZone=untrust InboundInterface=ethernet1/1 OutboundInterface=ethernet1/2 LogSetting=rs-logging SessionID=673161 RepeatCount=1 srcPort=21000 dstPort=12661 srcPostNATPort=22160 dstPostNATPort=6459 proto=tcp Action=block-url FileName=totally another fake filename URLCategory=custom-category VendorSeverity=Medium DirectionOfAttack=server to client SequenceNo=7003061085140561385 SourceLocation=east-coast DestinationLocation=AU PacketID=0 FileHash= ReportID=0 DGHierarchyLevel1=11 DGHierarchyLevel2=0 DGHierarchyLevel3=0 DGHierarchyLevel4=0 VirtualSystemName= DeviceName=xxxxx SourceUUID= DestinationUUID= IMSI=100002086896379 IMEI=100000001147849194 ParentSessionID=0 ParentStartTime=1970-01-01T00:00:00.000000Z Tunnel=GTP-U ContentVersion=50097 SigFlags=0 RuleUUID=ec14df0b-c845-4435-87a2-d207730f5ae8 HTTP2Connection=0 DynamicUserGroup= X-Forwarded-ForIP=xxx.xx.x.xx SourceDeviceCategory=L-Phone SourceDeviceProfile=l-profile SourceDeviceModel=Note 4G SourceDeviceVendor=Lenovo SourceDeviceOSFamily=K6 SourceDeviceOSVersion=Android v9 SourceDeviceHost=pan-505 SourceDeviceMac=596703749274 DestinationDeviceCategory=L-Phone DestinationDeviceProfile=l-profile DestinationDeviceModel=Note XT DestinationDeviceVendor=Lenovo DestinationDeviceOSFamily=K8 DestinationDeviceOSVersion=Android v8 DestinationDeviceHost=pan-506 DestinationDeviceMac=150083646537 ContainerID=1873cc5c-0d31 ContainerNameSpace=pns_default ContainerName=pan-dp-77754f4 SourceEDL= DestinationEDL= HostID=1010101010 EndpointSerialNumber=xxxxxxxxxxxxxx DomainEDL= SourceDynamicAddressGroup= DestinationDynamicAddressGroup= PartialHash=0 TimeGeneratedHighResolution=2021-09-21T01:51:53.779000Z ReasonForDataFilteringAction= Justification= NSSAINetworkSliceType=fd devTimeFormat=YYYY-MM-DD'T'HH:mm:ss.SSSZ
The following table identifies the File field names that the Log Forwarding app
uses when you forward logs using the LEEF log format.
When you
create a syslog forwarding profile
,
you can optionally create a profile token that the Log
Forwarding app uses when it sends logs to the syslog server. If you configure a profile token,
it appears in the log line immediately after the log type information (for example,
TRAFFIC, THREAT,
HIPMATCH, and so forth). The token will appear on
a parameter called profileToken.
|
LEEF Name
|
Query Name
|
Field Type
|
|---|---|---|